Bind resource for IGrantable is great, but can we add a option to turn off?

[singlewind]

A lot of high level resource implement bind method which will automatically grant permission to resources. In most of cases it is fine. However, it is not smart enough to check existing policies which will create a lot of polices until overflow. By default, each role only allow 20 policies attached to it.

[peterwoodworth]

I think most constructs provide a way to get around CDK adding policies automatically - could you give an example of your code which produces additional policies you don't want? If not, we can create a feature request as a better place to track this.

[singlewind]

For example, the glue job resource.

For a Python ETL, there is script, extraPythonFiles and extraJars properties as member of executable property accept Code class, which will bind the job role to give permissions for the s3 object. In a lot of use case, it is common share a same role if glue ETL jobs share the same environment. Then, it may create a lot of policies. I understand the motivation behind is developers don't need remember to grant the permissions for an individual resource any more which make it more mistake tolerant. In real life, all the script code should be in the same bucket anyway. A prefix with wildcard should resolve it nicely rather include all individual resources.

It is easy to work around though. we can create own class to implement Code abstract class to override the bind method to turn off. Here, I'm open this to discuss an elegant solution. Forgive me, if this has been already implemented.

[mhvelplund]

I have this exact problem. We use the same role and the same code asset for a bunch of jobs, and they all add exactly the same policy, eventually exceeding the max policy limits on the role.

[mhvelplund]

@peterwoodworth can you give an example of an L2 construct that provides a way to get around CDK adding policies automatically?